Consider the scenario where the /var/log directory contains the files secure, messages, cron, audit. A customer has created the following inputs.conf stanzas in the same Splunk app in order to attempt to monitor the files secure and messages:

Which file(s) will actually be actively monitored?

• A./var/log/secure, /var/log/messages
• B./var/log/secure
• C./var/log/messages
• D./var/log/messages, /var/log/cron, /var/log/audit, /var/log/secure

Comment: *

Name: *

Email: *

Verification: *

What is the Splunk PS recommendation when using the deployment server and building deployment apps?

• A.Carefully design smaller apps with specific configuration that can be reused.
• B.Only deploy Splunk PS base configurations via the deployment server.
• C.Use $SPLUNK_HOME/etc/system/localconfigurations on forwarders and only deploy TAs via the deployment server.
• D.Carefully design bigger apps containing multiple configs.

Comment: *

Name: *

Email: *

Verification: *

A slow search requires optimization. After running the search, the Search Job Inspector is opened for review of the execution costs. A large amount of time is being spent in the command.search.kv component. Which of the following should be examined to improve the performance?

• A.inputs.conf on deployment server.
• B.distsearch.conf on the search head.
• C.props.conf and transforms.conf on search head.
• D.eventtypes.conf on the search head.

Comment: *

Name: *

Email: *

Verification: *

A customer has a search cluster (SHC) of six members split evenly between two data centers (DC). The customer is concerned with network connectivity between the two DCs due to frequent outages. Which of the following is true as it relates to SHC resiliency when a network outage occurs between the two DCs?

• A.The SHC will function as expected as the minimum required number of nodes for a SHC is 3.
• B.The SHC will function as expected as the SHC deployer will become the new captain until the network communication is restored.
• C.The SHC will function as expected as the SHC captain will fall back to previous active captain in the remaining site.
• D.The SHC will stop all scheduled search activity within the SHC.

Comment: *

Name: *

Email: *

Verification: *

A non-ES customer has a concern about data availability during a disaster recovery event. Which of the following Splunk Validated Architectures (SVAs) would be recommended for that use case?

• A.Topology Category Code: M4
• B.Topology Category Code: M14
• C.Topology Category Code: C13
• D.Topology Category Code: C3

Comment: *

Name: *

Email: *

Verification: *